Back to results
US 10,885,184 B1Granted
Rearranging executables in memory to prevent rop attacks
AssigneeMcAfee, Inc.
InventorMatias Schnidrig
Life of this patent
Estimating the term…
Abstract
Methods, systems, and media for protecting against return-oriented programming malware are provided. In some embodiments, the method comprises: retrieving an executable module; identifying a basic block in the executable module located at a first memory location, wherein the basic block has one entry point and one exit point; moving a portion of the executable module that corresponds to the basic block to a random memory location from the first memory location; and replacing a destination of a function call to the basic block within the executable module with a representation of the random memory location.
Claims15
A method for protecting against return-oriented programming malware, comprising:
- retrieving an executable module;
- identifying a first basic block in the executable module located at a first memory location, wherein the first basic block is a code sequence with no branches in except one entry point and with no branches out except one exit point, using a hardware processor;
- determining whether the first basic block is associated with a main program or a library;
- in response to determining that the first basic block is associated with a library:
- moving a first portion of the executable module that corresponds to the first basic block to a random memory location from the first memory location;
- and
- replacing a destination of a first function call to the first basic block within the executable module with a representation of the random memory location by replacing the first function call to the first basic block with a second function call, wherein the first function call is a dynamic call, and wherein the second function call identifies the random memory location;
- identifying a second basic block in the executable module located at a second memory location, wherein the second basic block has one entry point and one exit point;
- determining whether the second basic block is associated with the main program or a library;
- and
- in response to determining that the second basic block is associated with the main program:
- leaving a second portion of the executable module that corresponds to the second basic block at the second memory location.
9 more elements
A system for protecting against return-oriented programming malware, the system comprising:
- a memory;
- and
- a hardware processor coupled to the memory that is configured to:
- retrieve an executable module;
- identify a first basic block in the executable module located at a first memory location, wherein the first basic block is a code sequence with no branches in except one entry point and with no branches out except one exit point;
- determine whether the first basic block is associated with a main program or a library;
- in response to determining that the first basic block is associated with a library:
- move a first portion of the executable module that corresponds to the first basic block to a random memory location from the first memory location;
- and
- replace a destination of a first function call to the first basic block within the executable module with a representation of the random memory location by replacing the first function call to the first basic block with a second function call, wherein the first function call is a dynamic call, and wherein the second function call identifies the random memory location;
- identify a second basic block in the executable module located at a second memory location, wherein the second basic block has one entry point and one exit point;
- determine whether the second basic block is associated with the main program or a library;
- and
- in response to determining that the second basic block is associated with the main program:
- leave a second portion of the executable module that corresponds to the second basic block at the second memory location.
12 more elements
A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method for protecting against return-oriented programming malware, the method comprising:
- retrieving an executable module;
- identifying a first basic block in the executable module located at a first memory location, wherein the first basic block is a code sequence with no branches in except one entry point and with no branches out except one exit point;
- determining whether the first basic block is associated with a main program or a library;
- in response to determining that the first basic block is associated with a library:
- moving a first portion of the executable module that corresponds to the first basic block to a random memory location from the first memory location;
- and
- replacing a destination of a first function call to the first basic block within the executable module with a representation of the random memory location by replacing the first function call to the first basic block with a second function call, wherein the first function call is a dynamic call, and wherein the second function call identifies the random memory location;
- identifying a second basic block in the executable module located at a second memory location, wherein the second basic block has one entry point and one exit point;
- determining whether the second basic block is associated with the main program or a library;
- and
- in response to determining that the second basic block is associated with the main program:
- leaving a second portion of the executable module that corresponds to the second basic block at the second memory location.
9 more elements
Dependencies are inferred from the claim text.